The vulnerability is caused by missing input validation in different XML parameters. This vulnerability could be exploited to inject and execute arbitrary shell commands.

WARNING: You do not need to be authenticated to the device to insert and execute malicious commands.Hint: On different devices wget is preinstalled and you are able to upload and execute your malicious binary.

06.06.2013 - discovered vulnerability
07.06.2013 - reported vulnerability to vendor
=> some fixes are available but there is no communication with the vendor
06.07.2013 - public disclosure at Sigint 2013
06.07.2013 - public disclosure of advirsory

Disclaimer

The views expressed on this site are my own and do not reflect those of my current employer or its clients. This "work" has been done in my free time and therefore it's not related to my current company in any way.

Potential intruders are in what military strategists call "the position of the interior": the defender has to defend against every possible attack, while the attacker has to find only one weakness.
Bruce Schneier (01-05-2001)